Information about data processing
V3 (August 2026)
TimeTac uses the onlyfy Application Manager (by XING) to process job applications. This Privacy Policy will inform you about the processing of your data by the onlyfy Application Manager (by XING) and by TimeTac.
Joint controllership
With regard to interaction within the company account of TimeTac, TimeTac and New Work SE have joint controllership pursuant to Article 26 GDPR, as they jointly determine the purposes and means of processing pursuant to Article 4 (7) GDPR. The current version of the agreement on joint controllership pursuant to Article 26 GDPR, which New Work SE concludes with companies that use onlyfy Application Manager, can be viewed here https://www.xing.com/terms/onlyfy-one to gain information on the key aspects of the agreement.
Data processing by New Work SE
onlyfy Application Manager is part of the extensive XING service operated by New Work SE, which pursues the aim of improving and simplifying users’ working lives with a variety of applications (onlyfy Application Manager, as well as the XING social and jobs network, kununu, etc.), and creates a more fulfilling world of work for individuals while boosting the performance of companies. As part of the extensive XING service, onlyfy Application Manager is an online platform on which or through which talent and companies meet.
With regard to data processing for which New Work SE is solely responsible or is responsible within the scope of the joint controllership with TimeTac, detailed information is available in the XING Privacy Policy at https://privacy.xing.com/en/privacy-policy. You will also find contact details for New Work SE, as well as for the New Work SE data protection officer there.
Job applications with onlyfy Application Manager
When submitting an application, you enter into a user relationship with New Work SE for the purpose of processing applications. In addition, you will receive support and New Work SE can present you with other opportunities in support of your career. A public profile will not be automatically created for you on the XING social and jobs network. The legal basis for New Work SE processing your data is, in particular, Article 6 (1)(b) GDPR (processing necessary for the performance of a contract).
Notes on the special functions of onlyfy Application Manager
Calendar function
If the calendar function is used, your data is processed during and for the purpose of setting appointments within the application process. The legal basis is Article 6 (1)(f) GDPR. The calendar function is provided by an IT service provider (Cronofy Ltd., United Kingdom). The United Kingdom is classified as a secure third country based on the adequacy decision of the European Commission. Further information on data protection at Cronofy is available here: https://www.cronofy.com/gdpr/ and https://docs.cronofy.com/policies/privacy-notice/.
WhatsApp application and communication via WhatsApp
If you apply via WhatsApp or if TimeTac contacts you via WhatsApp in connection with your application, the legal basis for the communication is your consent, which can be withdrawn at any time, pursuant to Article 6 (1)(a) GDPR. The communication may in particular be used to request application information, clarify follow-up questions, schedule appointments, send reminders, or enable other communication during the application process.
When applying via WhatsApp, the required applicant information is requested during a WhatsApp chat. The data is then transferred directly to onlyfy Application Manager via the service provider PitchYou and processed further there as part of and for the purpose of the normal application process. Candidate data from apply via WhatsApp are deleted from the apply via WhatsApp infrastructure in PitchYou immediately after the transfer. Further processing then takes place exclusively in onlyfy Application Manager.
The WhatsApp functions are provided by the IT service provider PitchYou, which may access your data for this purpose. More information is available here: https://www.pitchyou.de/en/pitchyou-gdpr. Please note that you use your personal WhatsApp account for the application or communication, and therefore processing by WhatsApp or Meta in their own responsibility takes place. A transfer, in particular to the USA, cannot be ruled out. WhatsApp data protection information is available here: https://www.whatsapp.com/legal/privacy-policy-eea.
You can withdraw your consent to communication via WhatsApp at any time with effect for the future. If you do not consent or withdraw your consent, no further communication via WhatsApp will take place.
Applicability of the Swiss Federal Data Protection Act (FADP)
The FADP applies to circumstances which have an impact on Switzerland, even if said circumstances are initiated outside of Switzerland. Correspondingly, this privacy policy applies to information in line with the EU GDPR and the FADP. Here, EU GDPR terminology is used in favour of FADP terminology. However, FADP terminology is used if the FADP applies and the terminology differs from EU GDPR terminology in a given language. The About this site section on XING contains the name and address of our representative in Switzerland.
YOUR PERSONAL DATA IN THE APPLICATION PROCESS
Version 2.4 (2026)
Information about data protection
We are pleased you have chosen to apply at TimeTac. Transparent and trustworthy handling of your personal data is an important foundation for successful collaboration. We wish to inform you how we process your data and how you can exercise your rights according to the General Data Protection Regulation (GDPR). The information below offers an overview of the collection and processing of your personal data in connection with the application process. Please read this Data Protection Declaration carefully before submitting your application.
1. General information
a) Who is responsible for the data processing?
The controller as defined by Art. 4 (7) GDPR is:
TimeTac GmbH, Schmiedgasse 31, 8010 Graz, Austria
b) How can I contact the data protection officer?
For questions about data protection, please email datenschutz@timetac.com.
2. What is personal data?
According to Art. 4 (1) GDPR, personal data is all data that refers to an identified or identifiable natural person.
3. Which data is processed?
3.1. The following data and data categories are processed within the application process:
Applicant master data (first name, last name, title, email address, telephone number, address, date of birth, citizenship)
Qualifications data (cover letter, personal statement, resume, previous experience, professional qualifications and skills)
Voluntary information, such as a photo, disability status or other information that you voluntarily share with us in your application or voluntarily upload
Additional questions depending on the respective position (e.g. driver’s license, citizenship)
Communication between you and us as well as comments and evaluations concerning you that are created during your application process
Other data / data categories, e.g. publicly accessible professional data such as profiles on professional social media networks like XING or LinkedIn
Special categories of personal data: If you provide information in your application documents that falls into special categories of personal data as defined by Art. 9 (1) GDPR (e.g. information that implies your sexual orientation; information on your health; information that implies your ethnicity or religion), we will also process this data only within the legally permissible framework.
3.2. The following additional data are processed in connection within the use of the platform:
a) Automated collection of usage data
When accessing the domain jobbase.io, your web browser automatically sends certain usage data for technical reasons. This information is stored separately from other data in log files. Prescreen collects the following information:
Date and time as well as duration of the access
Browser type/version
Operating system
URL of the previously visited web page
Quantity of data transmitted
A GeoIP lookup is performed based on your IP address (Internet Protocol address)
Names of the accessed files
http status code (e.g. “request successful”)
URL of the accessed web page
Access type (GET, POST)
This data is technically required in order to offer the functions of the e-recruiting system and to ensure the stability and security of the system. It is stored by Prescreen for a period of 12 months. Data that must be further retained for evidential purposes is excepted from the erasure until final clarification of the respective case.
The legal basis for processing of the data is Art. 6 (1) (f) GDPR.
b) Cookies
The legal basis for processing of the data is Art. 6 (1) (f) GDPR.
The cookies used by Prescreen can be found in the Prescreen Data Protection Declaration at: https://prescreen.io/en/datenschutzerklaerung/
4. For what purposes do we process your data and on what legal basis?
a) Consent – Art.6 (1) (a) and Art. 9 (2) (a) GDPR
If you have declared to us your consent for processing specific personal data, this consent then forms the legal basis for processing of this data.
In the following cases, we process your personal data on the basis of your consent:
- Inclusion in the candidate pool; in other words, we save your application documents after the current application process in order to consider you in subsequent application processes.
- handling of the application
If we base data processing on your consent, you have the right to withdraw this consent at any time with future effect. Please inform us of this revocation by email to datenschutz@timetac.com. The legality of the processing of your data up to the time of revocation remains hereby unaffected.
b) Data processing based on a legitimate interest – Art. 6 (1) (f) GDPR
In certain cases, we process your data to safeguard a legitimate interest of ours or of third parties. A legitimate interest applies, for example, if your data is required for the establishment, exercise or defense of legal claims in connection with the application process (e.g. claims according to the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidential purposes.
c) Feedback questionnaire
To optimize our application process and to improve as an employer, we offer you the opportunity to provide personal feedback. For this purpose, we will send with prior consent a feedback questionnaire to you at the specified email address. If you participate in the survey, our service provider Prescreen (see item 5 “With whom is your data shared?”) will collect the feedback, position title, location of the position, job category and type of employment for which you have applied. This information will then be shared with kununu GmbH and possibly other verified evaluation platforms and published there without inclusion of your name. Kununu cannot establish a relationship to your person. However, please note that other parties, such as your employer, may be able to identify you based on the information provided in the published feedback.
5. With whom is your data shared?
Your data is primarily processed by our Human Resources department. In some cases, other internal and external parties also participate in processing the data.
Internal parties could be specialized areas or departments of our company.
Our external service provider is New Work SE. New Work SE, Dammtorstraße 30, 20354 Hamburg (hereafter “Prescreen”), operates the e-recruiting system Prescreen under the domain *.onlyfy.io (hereafter “onlyfy.io”), where companies can post job ads as well as receive and manage applications.
As part of these activities, Prescreen processes personal data solely on behalf of and for the purposes of TimeTac and is therefore considered a processor according to Art. 4 (8) GDPR.
Onlyfy.io is the central platform for our applicant tracking. When using our online form, your personal data is entered directly into onlyfy.io. When an application is submitted by post or email, your data may also be transferred to the e-recruiting system.
In addition, we use Anthropic, PBC (548 Market Street, PMB 90375, San Francisco, CA 94104, USA) as a processor pursuant to Art. 28 GDPR for the AI-supported evaluation of incoming applications. Details about the use of AI can be found under Point 10.
6. For how long is your data stored?
(1) We store your personal data for as long as necessary for making the decision concerning your application. If you are not hired for the position in question, we may continue to store your data to the extent necessary for defending against possible legal claims. Your data will be deleted within 9 months after the end of the application process.
(2) If you are not hired but you have granted us consent to save your data (“candidate pool”), we will store your data until revocation of your consent or for a maximum of 24 additional months. Where specifically justified, we may also store your data for a longer time period for the purpose of defending against possible legal claims.
(3) If you retract your application before the end of the application process (in other words, if you delete your data and your account), the stored data will be restricted for the period of the continued application process and permanently deleted once 9 months have elapsed after the end of the application process.
(4) If you are no longer using your candidate profile and have not granted consent for continued data storage in the candidate pool, the data will be deleted within 9 months after the end of the application process.
(5) You can delete your candidate profile and your application documents, submit a deletion request or request a restriction of processing at any time.
7. What rights do you have in connection with the processing of your data?
(1) You can request information on whether we are storing personal data concerning you. Upon your request, we will inform you of what data is involved, the purposes for which the data is processed, who the data is shared with, for how long the data will be stored and what other rights you have in relation to this data.
(2) You also have the right to rectification or erasure of your data. You can also request that we make all personal data that you have shared with us available to you, another person or a company of your choice in a structured, commonly used and machine-readable format.
(3) You have the right not to be subjected to a decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you. Within the context of the application process, we use AI-supported procedures to prepare and structure the selection decision (see Point 10); the decision itself is always taken by a human being.
(4) You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6 (1) (e) GDPR (data processing for reasons of public interest) or on Art. 6 (1) (f) GDPR (data processing for safeguarding of a legitimate interest), including profiling based on those provisions. If you lodge an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise or defense of legal claims.
(5) You also have the right to lodge a complaint with the competent supervisory authority.
(6) To exercise your rights, you can contact us by email datenschutz@timetac.com. We will process your requests as quickly as possible according to the statutory requirements and inform you of the measures we have taken or will take.
8. Are you obligated to provide your personal data?
The provision of personal data is required neither by law nor by contract, nor are you obligated to provide the personal data. However, the provision of personal data is required for conducting the application process. In other words: if you do not provide us with any personal data along with an application, we cannot conduct the application process.
9. What happens if you interrupt your online application?
You can interrupt the creation of your online application at any time and continue it later. The platform utilizes technically necessary cookies for this purpose. Data is transmitted to jobbase.io during the application process. In other words: data you have provided for creation of a user account and any uploaded documents are entered into jobbase.io. The data remains here if you interrupt and/or do not conclude an application. In this case, your application is marked as incomplete, but the data remains visible to our company, to a limited extent.
You can view, edit or update the data you have provided within the context of the online application at any time in your candidate profile.
If you make no further changes in your candidate profile, such as concluding an ongoing application, starting a new application or changing the data of an existing application, your data will be deleted within 9 %applicationDataRententionUnit% after completion of the last active application process.
You can submit a request for erasure of your candidate profile and your application documents at any time. After the request for erasure has been submitted, you will be informed of the exact erasure date, and your data will be automatically deleted according to the conditions established in this Data Protection Declaration.
10. Use of Artificial Intelligence (AI) in the application process
a) What we do
To support our recruiting team in reviewing and evaluating incoming applications, we use an AI system. Specifically, we use the Claude language model provided by Anthropic, PBC (548 Market Street, PMB 90375, San Francisco, CA 94104, USA; hereinafter “Anthropic”) via the programming interface made available by Anthropic.
In particular, the AI system supports us in
- providing structured summaries of application documents,
- comparing qualifications and experience with the requirements of the advertised position, and
- generating suggestions for further consideration by our recruiting team.
b) What we do not do
Decisions concerning your application are not made solely on the basis of automated processing within the meaning of Art. 22 GDPR. Prior to any selection decision, each application is reviewed and independently evaluated by a member of our recruiting team. Decisions regarding invitation, rejection or further steps are taken exclusively by a human being who is in a position to critically question and override the suggestions made by the AI system and who bases his or her decision on the original application documents.
c) Legal basis
The legal basis for the AI-supported processing step is Art. 6 (1) (b) GDPR (performance of pre-contractual measures taken at your request) and, in addition, our legitimate interest pursuant to Art. 6 (1) (f) GDPR in an efficient, swift and consistent selection process for all applicants.
d) Which data is processed by the AI system?
The system processes the data you provide to us as part of your application (in particular CV, cover letter, evidence of qualifications and answers to any additional questions). We avoid processing special categories of personal data within the meaning of Art. 9 GDPR (e.g. health data, information indicating religion or ethnic origin) in the AI-supported step. Where you voluntarily include such information in your documents, it will not be used for the AI-supported evaluation.
e) Processor relationship and third-country transfer
Anthropic processes the data as a processor within the meaning of Art. 28 GDPR exclusively on our instructions. We have entered into a data processing agreement with Anthropic. Processing may take place on servers operated in the USA. The transfer to the USA is based on the EU-US Data Privacy Framework, to which Anthropic has self-certified; in addition, EU Standard Contractual Clauses pursuant to Implementing Decision (EU) 2021/914 apply.
f) No use of your data for AI training
We have contractually ensured that Anthropic does not use the application data we transmit for training or improving the AI models.
g) Your rights
In addition to the rights set out under Point 7 of this Privacy Policy, you have the following options:
- You may request that your application be processed exclusively manually by our recruiting team, without AI-supported pre-evaluation. A corresponding notice sent to datenschutz@timetac.com is sufficient; this will not result in any disadvantage in the selection process.
- You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR, pursuant to Art. 21 GDPR.